EIP-2026-117548

This exploit leverages DLL hijacking by creating a fake 'C:\Windows \System32' directory and dropping a malicious WINMM.dll. It then executes winSAT.exe from this directory, causing it to load the malicious DLL instead of the legitimate one.